// https://syzkaller.appspot.com/bug?id=a7e7703f43319750ed88a5c0d930d283b51f4e77 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[5] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0}; int main(void) { syscall(__NR_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x32ul, -1, 0); intptr_t res = 0; res = syscall(__NR_socket, 0x10ul, 3ul, 0ul); if (res != -1) r[0] = res; *(uint64_t*)0x200002c0 = 0; *(uint32_t*)0x200002c8 = 0; *(uint64_t*)0x200002d0 = 0x20000280; *(uint64_t*)0x20000280 = 0; *(uint64_t*)0x20000288 = 0; *(uint64_t*)0x200002d8 = 1; *(uint64_t*)0x200002e0 = 0; *(uint64_t*)0x200002e8 = 0; *(uint32_t*)0x200002f0 = 0; syscall(__NR_sendmsg, r[0], 0x200002c0ul, 0ul); res = syscall(__NR_socket, 0x10ul, 3ul, 0ul); if (res != -1) r[1] = res; res = syscall(__NR_socket, 0x10ul, 3ul, 0ul); if (res != -1) r[2] = res; res = syscall(__NR_socket, 0x10ul, 0x803ul, 0); if (res != -1) r[3] = res; *(uint64_t*)0x200001c0 = 0; *(uint32_t*)0x200001c8 = 0x397; *(uint64_t*)0x200001d0 = 0x20000180; *(uint64_t*)0x20000180 = 0; *(uint64_t*)0x20000188 = 0xff90; *(uint64_t*)0x200001d8 = 1; *(uint64_t*)0x200001e0 = 0; *(uint64_t*)0x200001e8 = 0; *(uint32_t*)0x200001f0 = 0; syscall(__NR_sendmsg, r[3], 0x200001c0ul, 0ul); *(uint32_t*)0x20000200 = 0xa; res = syscall(__NR_getsockname, r[3], 0x20000100ul, 0x20000200ul); if (res != -1) r[4] = *(uint32_t*)0x20000104; *(uint64_t*)0x20000040 = 0; *(uint32_t*)0x20000048 = 0; *(uint64_t*)0x20000050 = 0x20000000; *(uint64_t*)0x20000000 = 0x20000080; *(uint32_t*)0x20000080 = 0x48; *(uint16_t*)0x20000084 = 0x10; *(uint16_t*)0x20000086 = 0x705; *(uint32_t*)0x20000088 = 0; *(uint32_t*)0x2000008c = 0; *(uint8_t*)0x20000090 = 0; *(uint8_t*)0x20000091 = 0; *(uint16_t*)0x20000092 = 0; *(uint32_t*)0x20000094 = r[4]; *(uint32_t*)0x20000098 = 0; *(uint32_t*)0x2000009c = 0; *(uint16_t*)0x200000a0 = 0x28; *(uint16_t*)0x200000a2 = 0x12; *(uint16_t*)0x200000a4 = 0xc; *(uint16_t*)0x200000a6 = 1; memcpy((void*)0x200000a8, "veth\000", 5); *(uint16_t*)0x200000b0 = 0x18; *(uint16_t*)0x200000b2 = 2; *(uint16_t*)0x200000b4 = 0; *(uint16_t*)0x200000b6 = 1; *(uint8_t*)0x200000b8 = 0; *(uint8_t*)0x200000b9 = 0; *(uint16_t*)0x200000ba = 0; *(uint32_t*)0x200000bc = 0; *(uint32_t*)0x200000c0 = 0; *(uint32_t*)0x200000c4 = 0; *(uint64_t*)0x20000008 = 0x48; *(uint64_t*)0x20000058 = 1; *(uint64_t*)0x20000060 = 0; *(uint64_t*)0x20000068 = 0; *(uint32_t*)0x20000070 = 0; syscall(__NR_sendmsg, r[2], 0x20000040ul, 0ul); *(uint64_t*)0x20000140 = 0; *(uint32_t*)0x20000148 = 0; *(uint64_t*)0x20000150 = 0x20000000; *(uint64_t*)0x20000000 = 0x20000200; *(uint32_t*)0x20000200 = 0x3c; *(uint16_t*)0x20000204 = 0x10; *(uint16_t*)0x20000206 = 0x581; *(uint32_t*)0x20000208 = 0; *(uint32_t*)0x2000020c = 0x6558; *(uint8_t*)0x20000210 = 0; *(uint8_t*)0x20000211 = 0; *(uint16_t*)0x20000212 = 0; *(uint32_t*)0x20000214 = r[4]; *(uint32_t*)0x20000218 = 0; *(uint32_t*)0x2000021c = 0; *(uint16_t*)0x20000220 = 0x14; *(uint16_t*)0x20000222 = 0x12; *(uint16_t*)0x20000224 = 0xc; *(uint16_t*)0x20000226 = 1; memcpy((void*)0x20000228, "ipvlan\000", 7); *(uint16_t*)0x20000230 = 4; *(uint16_t*)0x20000232 = 2; *(uint16_t*)0x20000234 = 8; *(uint16_t*)0x20000236 = 5; *(uint32_t*)0x20000238 = r[4]; *(uint64_t*)0x20000008 = 0x3c; *(uint64_t*)0x20000158 = 1; *(uint64_t*)0x20000160 = 0; *(uint64_t*)0x20000168 = 0; *(uint32_t*)0x20000170 = 0; syscall(__NR_sendmsg, r[1], 0x20000140ul, 0ul); return 0; }